ts-agent-sdk
Warn
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The DBClient implementation in templates/db/client.ts uses child_process.execSync to execute CLI commands (npx wrangler d1 execute) when in local mode. The command string is built by interpolating SQL queries and database names from environment variables. Although single-quote escaping is applied to the SQL string, dynamically building shell commands from potentially untrusted input is a dangerous pattern that can be exploited if escaping is bypassed or if environment variables are manipulated.- [DYNAMIC_EXECUTION]: In templates/db/client.ts, the executeLocalRaw method constructs and executes shell commands at runtime based on provided SQL strings and parameters. This pattern represents the dynamic creation and execution of system commands from application-level variables.- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from various external sources which could contain malicious instructions designed to subvert the agent's behavior.
- Ingestion points: Data is retrieved from Cloudflare D1 databases (templates/db/client.ts), Google Gemini API responses (templates/api/gemini.ts), and the Nager.Date public API (templates/api/public/holidays.ts).
- Boundary markers: There are no explicit boundary markers or instructions to ignore embedded commands within the data ingestion methods.
- Capability inventory: The skill possesses the ability to execute shell commands, perform network operations, and write to databases.
- Sanitization: While the database client implements identifier escaping for SQL, there is no evidence of sanitization for natural language instructions that might be present in the data returned from APIs or databases.
Audit Metadata